Access to/Sharing of Personal Health Information (PHI) and the Use of Health Home Consents #HH0009

Policy Title: Access to/Sharing of Personal Health Information (PHI) and the Use of Health Home Consents
Policy number: HH0009
Effective date: August 1, 2018
Last revised: June 6, 2019; May 1, 2022, July 13, 2026 (Implementation: September 1, 2026)
Approved by:                      Date:

Applicable to: This policy pertains to adults and children eligible for enrollment/ continued enrollment in the Health Home Program.

Upon the last revised date, this policy replaces any information provided in prior versions of this policy, Medicaid Updates and guidance webinars posted on the Department of Health's Health Home website related to this subject matter.

Contents

Purpose
Definitions

  1. Scope
  2. Health Home Consent Forms
  3. Protected Health Information (PHI)
  4. Procedures
    1. Health Home Enrollment/Continued Enrollment
      1. DOH-5055 Health Home Patient Information Sharing Consent
      2. Health Home Consent Frequently Asked Questions (FAQ) For Use with Children Under 18 Years of Age and the DOH-5201 Health Home Consent - Enrollment and Information Sharing For Use with Children and Adolescents Under 18 Years of Age 10
      3. DOH-5203 Health Home Consent Release of Educational Records
      4. Updating Consent
    2. Disenrollment from the Health Home Program
      1. DOH 5204 - Withdrawal of Release of Educational Records
  5. When a New Consent Must Be Obtained
  6. Acceptable Practices for Obtaining Signatures
  7. Training
  8. Quality Monitoring Program
  9. Relevant Statutes and Standards
  10. Policies and Resources

Purpose

The New York State Department of Health (the Department) is responsible to assure that Health Homes (HH) have policies and procedures in place that provide clear guidance and expectations regarding the use of Health Home consents for both adults and children. Policies and procedures must include identification of key Federal (HIPAA) and State regulations that govern access to/release of Protected Health Information (PHI) and safeguards to ensure the security and proper use of member PHI for the purpose of coordinating care. The sharing of an enrolled HH member's PHI means a timely and coordinated effort that incorporates the CANS-NY/HCBS assessment (for children), the comprehensive assessment, and the subsequent development of a person-centered plan of care and serves to prevent the potential for duplication of services. Health Home Care Managers (HHCM) must assure members are informed about the importance of information sharing, the type and degree of information being shared, and the member's right to limit the sharing of information between entities. In addition, enrolled members must be provided with information on where to file a complaint if s/he feels their PHI was used without their permission.

Enrollment in the Health Home Program is voluntary. An individual's decision to/not to enroll is documented through completion of applicable HH consent(s). Consent form(s) document the member's approval for accessing and sharing Protected Health Information (PHI) between specified entities named in the consent (e.g., HH, CMA, Medicaid Managed Care Plan (Plan), healthcare providers, family and other supports, etc.).

Consents also provide a method for documenting member choice related to continued enrollment and services, the member's approval of changes in healthcare providers, non-healthcare services, personal supports, and others throughout the member's enrollment in the Health Home program.

Definitions

Assisted Outpatient Treatment (AOT): also known as Kendra's Law in NYS, is a civil court process mandating adults with serious mental illnesses, who have a history of not engaging in treatment resulting in episodes of instability and behavior that is dangerous to themselves or others, to receive assistance needed to effectively participate in out-patient treatment. Through a court order, individuals are referred for Health Home enrollment under Health Home Plus (HH+). Laws and Regulations related to AOT include: Article 9.60 of the Mental Hygiene Law; Title 14 of the New York Codes, Rules, and Regulations. Also see: Office of Mental Health – Assisted Outpatient Treatment (AOT) website

Member or Participant: The individual (both adult and children/youth) enrolled in the Health Home program. The term includes the Parent, Guardian, and Legally Authorized Representative of the member, as applicable. These terms are interchangeable.

I. Scope

HHs must assure that CMA staff are informed, trained and maintain responsibility for the processes identified in this policy. Members and their parent/guardian/legally authorized representative, Plan, healthcare providers, service agencies, and other entities approved by the member are included in the process.

II. Health Home Consent Forms

HHs must assure that New York State Department of Health authorized and numbered consents are used and completed correctly.

The following chart lists the Health Home consents described in this policy, currently in use. Each of these consents serves a specific purpose and includes any variances for use between adults and children.

Additionally, to assist when completing consent forms for HHSC, the Health Homes Serving Children: Consent Document Guidance can be found on the HHSC Consent Forms and Templates page under: Health Home Serving Children Consent Guidance Documents and Supportive Information.

Form Number Form Title Used For:
DOH-5055 Health Home Enrollment and Information Sharing Consent
  • Adults
  • Children/youth 18 years of age or older, or child/youth under age 18 if they are a parent, pregnant or married and able to self-consent, or Homeless youth
FAQ Health Home Consent Frequently Asked Questions For Use with Children and Adolescents Under 18 Years of Age
  • Children/youth under age 18 who are not a parent, pregnant and/or married and cannot self-consent and need a parent, guardian or legally authorized representative to consent
DOH-5201 Health Home Consent - Enrollment and Information Sharing For Use with Children and Adolescents Under 18 Years of Age
DOH-5203 Health Home Consent Information Sharing of Educational Records
DOH 5204 Health Home Consent Withdrawal of Release of Educational Records For All Individuals in Health Home Program

III. Protected Health Information (PHI)

The Office for Civil Rights enforces the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule, which protects the privacy of individually identifiable health information; the HIPAA Security Rule, which sets national standards for the security of electronic protected health information; the HIPAA Breach Notification Rule, which requires covered entities and business associates to provide notification following a breach of unsecured protected health information; and, the confidentiality provisions of the Patient Safety Rule, which protect identifiable information being used to analyze patient safety events and improve patient safety.

For information related to HIPAA Privacy Rules, refer to The Office for Civil Rights HH are required by law to report any PHI breach as per the HIPAA Breach Notification Rule, 45 CFR §§ 164.400-414 which can be accessed on the US Department of Health and Human Services website.

Additionally, as per the Data Use Agreement (DUA), HHs are required to report any PHI breach involving a HH member that occurs within the HH or its network providers to the NYS DOH Bureau of Security and Privacy at: doh.sm.Medicaid.Data.Exchange@health.ny.gov HHs must assure that enrolled members are provided with information on where to file a complaint if s/he feels their PHI was used without their permission (refer to information contained within Health Home consent forms (DOH-5055, DOH-5201, and FAQ document).

IV. Procedures

HH policies and procedures must include the use of consent forms specific to activities related to enrollment, continued enrollment, and disenrollment and address protections related to PHI.

Policies and procedures must include, but are not limited to the following:

  1. compliance with all state and federal laws, DOH guidance documents, and HH policy related to consents to prevent unauthorized access and sharing of Protected Health Information (PHI);
  2. use of appropriate DOH-numbered form(s);
    • Note: Forms can be entered into the electronic health record (EHR) as long as the document is not altered in any way and the integrity and specific wording/language of the form is unchanged
  3. when appropriate, ask the member if they have any supporting documentation that directs signing of consent to be done by someone other than the member, for instance if the member is unable to sign for themselves due to a physical limitation;
  4. identify if the member has a Legal Guardian to sign on behalf of the member;
  5. address processes to update consents and assure consents remain on file (for example when a member who could not previously self-consent can now self- consent such as when a child turns 18 years of age, or become pregnant, married, or a parent);
  6. address and document any limitations/restrictions set by the member regarding the sharing of PHI, and the use of agency-specific HIPAA compliant consent forms to document such limitations, where applicable. For example: member wants daughter listed as emergency contact but has not given her access to other specified information;
  7. assure member rights are addressed during the signing of consent. Individual(s) signing consent (member and/or designee) must fully understand the content and intended use: e.g., voluntary enrollment; the sharing of (PHI) to support the provision of HHCM services; the development of a plan of care and establishment of a care team (multidisciplinary team) approved by the member; ability to update consent information; etc. (For HHSC, the required FAQ and documentation that the FAQ was reviewed with the parent/guardian/legally authorized representative accomplishes ensuring the understanding of the signed consent forms);
  8. use of forms in the language most suitable for the member with regard for limited English Proficiency (LEP), cultural competency, physical limitations, etc.;
  9. offer and provide a copy of the completed and signed consent form(s) to the member;
  10. maintain completed and signed consents in the member's record, or document why a required consent or parts of consent were not completed;
  11. assure a system is in place for HHs to obtain information from their CMAs to support the transfer of consent information into the MAPP-HHTS.
    • The MAPP-HHTS must be used to document the presence of consent and sharing of information (PHI) for adults and children accordingly upon enrollment, throughout the duration of enrollment (e.g., when a new consent is signed), and upon disenrollment. Information related to consent must be accessible via MAPP-HHTS at any time for auditing purposes.

      Important to Note: The DOH-5055 and the DOH-5201 are each designed as a consent document that combines both enrollment and sharing of PHI into one form.

      When a situation warrants that a member's segment in MAPP-HHTS ends the HH must correctly update consent information as appropriate. Consent information may be carried forward when a new segment is created if the initial consent has remained in place and is unchanged.
  12. document and act upon any member-approved changes to the consent in a timely manner, and assure entities involved in the member's care team are informed;
  13. a system must be in place to assure communication between CMA and HH occurs when a member is enrolled/denied enrollment/disenrolled to support issuance of a Notice of Determination. Refer to: Health Home Notices of Determination and Fair Hearing policy #HH0004 under: Eligibility
  14. CM core services must not be billed without an appropriately completed and signed consent; and,
  15. define actions to be taken to report a violation of PHI as per State and Federal laws, and Health Home policy.
    • Note regarding AOT:
      Policy must include procedures for obtaining consent for individuals enrolled in the Health Home Program under court-ordered Assisted Outpatient Treatment (AOT).

      If an individual on Assisted Outpatient Treatment (AOT) refuses to sign the Health Home consent form, the AOT court order acts as the official authorization for enrollment. The care manager should document the refusal and note "AOT order" on the signature line to enable care management and billing.

      AOT and HH+ are specific to adult Health Homes. Children and youth being served in HHSC that have an AOT order must be served by an appropriate AOT CMA and in the HH+ program, therefore transferred to an adult Health Home.

Sections A-B to follow identify the various Health Home consent forms and describe their use in relation to enrollment, continued enrollment, and disenrollment, as appropriate.

A. Health Home Enrollment/Continued Enrollment

When the HH/CMA confirms an individual meets all appropriate eligibility criteria for enrollment into the Health Home Program, and the individual chooses to enroll, appropriate consent must be obtained to complete the enrollment process. HHCMs must confirm the members' understanding of what they are consenting to, and that signing consent confirms the member's choice to enroll and approval to access/share PHI (DOH-5055 or DOH-5201) with entities approved by the member. HHs must be sure that individuals understand that without a signed consent, enrollment cannot occur or continue. If during the enrollment process or anytime during enrollment, the individual refuses to sign consent, the HHCM must discuss the purpose of consent for enrollment/continued enrollment and the individual's reason/s for refusal. If the individual continues to refuse to sign, enrollment/continued enrollment cannot occur.

Consent must include, at a minimum, the following:

  • the name of the CMA, and
  • member's Managed Care Plan if applicable, and
  • If already identified, primary care physician and/or healthcare provider from whom the member receives the majority of care (e.g. mental health, substance use, etc.). This includes the healthcare professional treating the chronic condition(s) identified for enrollment of the member into the HH if such professional is someone other than the primary care physician.

Consent guides the process for establishing and maintaining the member's care team and identifies to what extent each entity may receive or share member PHI. As a ‘living document', consent may change over time to include new healthcare providers, service agencies, family and supports, etc. The member is informed about the importance of including additional providers, services, supports and others to provide a greater level of care and support to the member in meeting his/her goals. Evidence of such changes must be documented in the member's consent, minimizing the potential for misuse of PHI.

IMPORTANT:

Health Homes and Care Management Agencies may not ask or instruct members to approve an entire pre-filled network list in anticipation of an entity possibly becoming a service provider for the member in the future. Consent must clearly identify only those entities approved by the member directly involved in the member's care team/plan of care at the time of signing and updating consent to align with member choice and protect the member's Protected Health Information (PHI).

Health Homes monitor and assure that proper protocols are being followed to complete Health Home consents (for example: DOH-5055, DOH 5201, etc.) and address any issues identified to prevent potential for misuse of member Protected Health Information (PHI).

Forms used for enrollment/continued enrollment are as follows:

  1. DOH-5055 Health Home Enrollment and Information Sharing Consent The DOH-5055 is used to enroll/maintain enrollment for HH members who are adult, children/youth 18 years of age or older, or child/youth under age 18 if they are a parent, pregnant or married, Homeless Youth, and able to self-consent.

    Completing DOH-5055, pages 1-3:

    On page 1, the full name of the Health Home must be used (which autofills into other areas of the consent form).

    On page 2, the box confirming the individual's choice to enroll and share PHI must be checked followed by the Member's signature, Date of Birth, and Date the consent form is signed by the Member (or Member's Legal Representative.

    On page 3, the fillable lines must all be completed to provide required contact information, as outlined.
    Note regarding limitations on information sharing:

    While completing this consent form, a member is informed of the various means through which his/her health information may be accessed by the HH and assigned CMA/HHCM. As outlined on page 1, these include: the Statewide Health Information Network for New York (SHIN-NY), the Psychiatric Services and Clinical Enhancement System (PSYCKES); TABS/CHOICES (run by the New York State Office for People With Developmental Disabilities OPWDD), the Uniform Assessment System NY (UASNY) and, the Single Point of Access under the authority of the Local Government Unit (SPOA/LGU).

    While completing the required Health Home consent form, if the member requests limited access to/sharing of PHI with certain approved entities, for example: between selected healthcare providers; for non-healthcare agencies/services; and, for the member's ‘emergency contact', the HHCM must assure these entities are documented on a separate HIPAA- compliant consent form to be maintained with the completed and signed HH consent form in the member's record. This alternate form can be provided by the CMA or by the agency requesting the information. The document must clearly reflect the member's choice, define the information to be accessed/shared, identify the purpose, indicate if time limited, etc.

    The process must include appropriate means of communicating limitations between entities as appropriate to the situation.

    Options for completing DOH-5055, page 4

    Page 4 is used to list healthcare providers, family/supports and other entities approved by the member, given full access to PHI, and integrated into all aspects of the member's plan of care.
    • If using a blank page 4:
      In addition to listing the CMA, member's Plan, and the member's primary care physician or healthcare provider from whom the member receives the majority of care reflective of the chronic condition for which the member was enrolled in a Health Home (e.g. behavioral health, substance use, etc.), the HHCM must:
      • list any other healthcare providers (e.g., hospital, etc.) approved by the member for whom full access has been given. It is appropriate to also list family or significant other(s) for whom the member has authorized full access.
    If using pre-listed HH network partners on page 4:
    In addition to listing the CMA, member's Plan, and the member's primary care physician or healthcare provider from whom the member receives the majority of care reflective of the chronic condition for which the member was enrolled in a Health Home (e.g. behavioral health, substance use, etc.), the HHCM must clearly identify entities approved by the member as follows:
    • place a check mark ( ✓ ) next to every entity approved by the member; OR,
    • cross out (---) all entities except those that the member has approved; AND,
    • have the member (or consenter) and HHCM initial and date next to each entity approved by the member.
    Homeless Youth to Self-Consent for Health Homes Serving Children and Children's Waiver of Homes and Community Based Services

    In accordance with Public Health Law §2504, as amended by chapter 107 of the Laws of 2023 and further defined in Executive Law § 532-a, children/youth under the age of eighteen (18) who meet the definition of "homeless youth" or youth who are receiving services at an approved "Runaway and Homeless Youth (RHY) Crisis Services Program" or a "Transitional Independent Living Support Program (TILP)" may self-consent for Health Home Serving Children and Home and Community Based Services. In these instances, the DOH-5055 Health Home Enrollment and Information Sharing Consent is used for self-consenting children/youth. Health Homes will follow all steps outlined in the Homeless Youth to Self-Consent for Health Homes Serving Children and Children's Waiver of Homes and Community Based Services policy #HH0019 for children/youth who meet these criteria.
  2. Health Home Consent Frequently Asked Questions (FAQ) For Use with Children Under 18 Years of Age and the DOH-5201 Health Home Consent - Enrollment and Information Sharing For Use with Children and Adolescents Under 18 Years of Age
    1. FAQ Health Home Consent Frequently Asked Questions (FAQ) For Use with Children Under 18 Years of Age

      A child/youth under age 18, and the parent, guardian or legally authorized representative must be provided a copy of Health Home Consent Frequently Asked Questions (FAQ) For Use with Children Under 18 Years of Age which explains the Health Home program and services, and consent for information sharing and Health Home enrollment. The form must be reviewed with the child/youth and the parent, guardian, or legally authorized representative prior to completing and signing the DOH-5201, which contains statements confirming that the FAQ document was reviewed and understood by the child and their parents, guardians, or legally authorized representatives.

      Note for the Health Home Serving Children's (HHSC) program:
      Children who are parents, pregnant, and/or married, and who otherwise capable of consenting, should not be given this document. Instead, they should be given the DOH-5055 Health Home Patient Information Sharing Consentform to review and complete.
    2. DOH-5201 Health Home Enrollment and Information Sharing For Use with Children Under 18 Years of Age
      The DOH-5201is completed for children/youths under age 18 who are not a parent, pregnant and/or married. This form outlines what, and with whom the child/youth's health information can be shared.

      The DOH-5201 has two sections, which must be completed as follows:
      • Section 1:
        To be completed onlyby the Parent, Guardian or Legally Authorized Representative of children under the age of 18. The Parent, Guardian, or Legally Authorized Representative should be informed that:
        • Health providers may share information from before or after the signature date on the consent form.
        • Consent to share information can be recorded, modified and withdrawn at any time.
        • The child can keep private any information about services that the
        • child/youth has the right to self–consent to receive (see Section 2).
      • Section 2:
        Children/youth must be afforded the opportunity to complete Section 2 in the presence of the Health Home care manager and not with the parent, guardian or legally authorized representative. Children must be age 10 and older to complete Section 2 – Part A; age 12 and older for Section 2 – Part B.
        • The child/youth can keep private any of their information regarding family planning, emergency contraception, abortion, sexually transmitted infection testing and treatment, HIV testing, treatment and prevention, prenatal care, labor and delivery services, drug and alcohol treatment, or sexual assault services.
        • Section 2 must be completed unless any of the following reasons apply:
          • Child/youth does not meet age requirement;
          • permission denied to meeting alone with the child/youth by the parent/guardian/legally authorized representative;
          • child/youth states they are not currently receiving minor protected, and mental health and developmental disabilities services;
          • child/youth is not able/willing to complete.
        • If DOH-5201 Section 2 is NOT completed for any of the reasons listed above, information may NOT be released or shared with providers. The HHCM:
          • documents the reason(s) in the member's record and also completes the Health Home Care Management Tracker For Section 2 .
          • continues to approach the child/youth throughout providing Care Management services to complete Section 2 (e.g. child turns 10; child is receiving minor protected, mental health, development disabilities services; child is able/willing; parent/guardian/legally authorized representative gives permission for HHCM to meet alone with child; etc.). All attempts must be documented in the member's record and on the Health Home Care Management Tracker For Section 2.
        • In addition, if child/youth is specifically receiving mental health services and is over the age of twelve (12), the mental health provider may ask the child/youth if they want their information disclosed.
        • If the parent, guardian, or legally authorized representative consented for these services or is aware of these services (mentioned above) on behalf of the child/youth, then the parent, guardian, or legal authorized representative may have the authority to consent for the release of information for these services. However, the child/youth must also consent to the release of this information.
      Once the DOH-5201 is in place, an additional consent form is signed that allows for access to information needed to support the development of the member's plan of care, as follows:
  3. DOH-5203 Health Home Consent Release of Educational Records

    The DOH-5203is for consent to release educational records to a Health Home for children and youths who have been enrolled in a Health Home, if the child/youth is enrolled in school. It includes information on what educational records and with whom educational records can be shared.

    Consent for release of educational records for children and youths under age 18 must be provided by the parent as defined in Question 5 of the DOH-5203. Consent for release of educational records for those aged 18 and over must be provided by the individual.

    New York State Education (NYSED) requires a different consent to release educational records because they are covered by Family Educational Rights and Privacy Act (FERPA) and not the Health Insurance Portability and Accountability Act (HIPAA). The definition of parent in DOH-5203 is also different from other Health Home consent forms. Please refer to DOH-5203 for the complete definition of parent, guardian or legally authorized representative.
    • Note: This also applies to education records that are directly related to an infant or toddler in the Early Intervention Program (EIP) or records from a local early intervention official.
    Obtaining the DOH-5203 does not impact the enrollment process. However, HHCMs must discuss completion of this form with the member or parent, guardian or legally authorized representative, and document any instances where this consent is not signed and the reason. The HHCM must attempt to secure consent by approaching the member or parent, guardian or legally authorized representative at a later time.
    • Note: For more in-depth information regarding the Health Home Serving Children's (HHSC) consent forms, please reference the HHSC Consent Form Guidancedocument via the following link:
  4. Updating Consent

    Consents are updated when there is a change in: healthcare provider, family/consenter, significant other(s) or supports; emergency contact; service agency; care management agency; the member's Plan; Behavioral Health Organization (BHO); etc. All other HIPAA compliant forms also on file for the member are to be updated when there is a change in applicable providers.
    • Note for HHSC: In addition, when a child turns ten years of age, DOH-5201 Section 2 is to be revisited with the child (if s/he has the ability to answer Section 2 questions – refer to DOH-5201, Section 2 above, including completion and use of the Health Home Care Management Tracker For Section 2).
    HHCMs notify appropriate entities regarding changes made to the consent to maintain continuity of care and assure proper protections for the use of the member's PHI.

    When updating consent with the member, the HHCM assures the same method is used each time to prevent any confusion and potential misuse of PHI (e.g., for the DOH-5055, if Option 1 was used to complete consent for enrollment, then Option 1 must be used whenever any changes to consent occur).

    REMEMBER: All changes to consent must be dated and initialed by both the member (or consenter) and the HHCM.

    HHCMs review the member's consent(s) at least annuallywith the member to assure it is accurate and reflects up-to-date information regarding the member's selection and address any needed updates. The member's consent should be reviewed when the comprehensive assessment and/or the plan of care is being updated or when there is a significant life event that occurs with the members, or when new providers are referred or involved and/or the member/Parent/Guardian/Legally Authorized Representative requests a change, as it is at these times when additional providers and or information regarding the member will be needed by the HHCM.
    • Note: In addition, when a child turns ten years of age, DOH-5201 Section 2 should be revisited with the child (if s/he has the ability to answer Section 2 questions – refer to DOH-5201 Section 2 above, including use of the Health Home Care Management Tracker For Section 2, as appropriate).
  5. Disenrollment from the Health Home Program

    When an enrolled HH member voluntarily chooses to disenroll from the HH program, the CMA/HHCM must take all steps necessary to complete the disenrollment process to end the member's enrollment and the sharing of member PHI and other pertinent information (e.g., educational records). HHs must assure that policies and procedures include, but are not limited to the following:
    1. The HHCM must provide written confirmation to the enrolled member to assure understanding of the intent to disenroll from the Health Home Program and end consent to share PHI (or other pertinent information), the effective date, how to obtain records/documents, and information on requesting consideration for re-enrollment in the future. The HHCM must document this information including the issuance of the written notification in the member's record.
    2. The HHCM must assure that the member's care team is notified of the disenrollment date making certain that access to/sharing of PHI ceases, as appropriate.

      Additional information related to member disenrollment can be found:
    Forms used to disenroll HH members are described as follows:
    1. DOH 5204 - Withdrawal of Release of Educational Records
      The DOH 5204is used to withdraw consent to release educational records (which includes Early Intervention Program records) for children and youths who have been enrolled in a HH. In addition to the time of disenrollment from the Health Home program, a request to withdraw a release of educational records can occur at any time during the child/youth's enrollment. Withdrawal of consent for release of educational records for children under age 18 must be provided by the parent, guardian or legally authorized representative. Withdrawal of consent for release of educational records for those aged 18 and over must be provided by the individual.

V. When a New Consent Must Be Obtained

There are situations that warrant the completion of a new consent form(s). HH/CMAs assures that the correct consent form(s) is completed and signed by the member, and that providers and others listed in the consent form are notified accordingly. Reasons for obtaining new consent include, but are not limited to when the following occurs if:

  • the child/youth turns 18 years old, (if he/she did not previously consent for him/herself);
  • the child/youth changes from foster care to non-foster care or non-foster care to foster care;
  • the child/youth under age 18 gets married, becomes pregnant, becomes a parent, or meets the Homeless Youth criteria;
  • the consenter for children under 18 years of age changes;
  • the child changes schools/districts (refers to use of DOH-5203 for HHSC);
  • the member re-enrolls in the Health Home program following disenrollment;
    • Note: When a new consent form is needed due to the circumstances listed above, the new consent form to enroll and information sharing MUST occur within the month of the event, to ensure continuity of care management services and the ability to bill for such services.
  • a Health Home has changes in its structure and/or network: Certain structure/ network changes may result in the need for a new Health Home consent to be signed by enrolled members. HHs must follow the guidelines as defined in the "Requirements and Instructions For Using the Notification of Change Form" document, which can be accessed via the Department's Lead Health Home Resource Center webpage - under: Administrative Requirements for Health Homes (see: Notification of Change Form); or,
  • a member changes Health Homes, Care Management Agency, or both. Health Homes must follow guidelines related to consent (and other documentation) outlined in the Process for Transferring Health Home or Children's Waiver Enrolled Members to Another Health Home and-or Health Home Care Management Agency policy HH0018.

VI. Acceptable Practices for Obtaining Signatures

In addition to signing consent via wet signature (ink on paper) the practice of obtaining member signature via electronic means is acceptable as long as Health Homes and Care Management Agencies are in compliance with all applicable New York State and Federal laws.

Consent forms may be provided to and received back from members/consenters, completed and signed either in person, via regular mail, through email/scan or fax, or through other secured electronic means.

Refer to the following links:

VII. Training

Health Homes assure that policies and procedures related to training for staff on the subject of PHI and Consent include, but are not limited tothe following:

  1. familiarity with the various laws and requirements for adults and children associated with consent;
  2. the use, purpose, and completion of Health Home consents for adults and children;
  3. managing member refusals to sign consent forms;
  4. protection of PHI, and agency specific and DOH required reporting protocols for HHs and CMAs; and,
  5. how to engage members regarding the various consents and obtaining the appropriate signatures, and provider information for the HHCM to assist the member with quality care management to in meeting the member's health and wellness needs.

VIII. Quality Monitoring Program

HHs must evaluate patterns of use for Health Home consents within its network and establish Quality Monitoring activities to address any issues identified.

HHs assure quality monitoring activities are in place. Activities monitored include, but are not limited to:

  1. enrollments that did not occur due to refusal by individuals to sign consent;
  2. proper management of member enrollment under AOT order if member refuses to sign consent;
  3. members were enrolled in the presence of a correctly completed and signed consent form(s);
  4. updates to consent were made correctly and timely upon changes in providers, services, and others approved by the member and/or Parent, Guardian/Legally Authorized Representative, etc.;
  5. proper notification to member's care team to cease sharing of information upon the member's disenrollment, as appropriate;
  6. timely notification to Health Home at member disenrollment for distribution of NODs;
  7. identification of violations in management of PHI, immediate actions taken to report a violation of PHI as per state and federal laws and HH policy, actions taken to correct the violation and prevent reoccurrence;
  8. meet required timelines for ensuring consents were signed for Health Home structure/network changes;
  9. meet required timelines if a member/s changes Health Homes, Care Management Agency, or both.

IX. Relevant Statutes and Standards

  • Federal regulations for Health Information Portability and Accountability Act (HIPAA) 42 CFR 431.302, 42 CFR Part 2
  • Health Information Portability and Accountability Act (HIPAA) 45 CFR Parts 160, 162 and 164
  • Privacy and security of personally identifiable information 45 CFR 155.260
  • New York State Social Services Law Section 369 (4), Section 367b(4)
  • New York Mental Hygiene Law Section 33.13 and 33.16
  • Social Security Act,42 USC 1396a (a)(7)
  • New York Public Health Law Article 27–F
  • Family Educational Rights and Privacy Act (FERPA) 34 CFR Part 99
  • 10 NYCRR Part 300 – Statewide Health Information Network for New York (SHIN- NY);
  • NY Mental Hygiene Laws 41.05, 41.07 and 41.13

X. Policies and Resources

Additional information about Health Home Consents and PHI and other information referenced in this policy can be accessed on the DOH Health Home website via the following links: